feat(auth): password reset deep link + auth UI polish + security fixes

.github/workflows/ci.yml

@@ -69,7 +69,11 @@ jobs:
         run: pip install -r requirements.txt
 
       - name: Install test dependencies
-        run: pip install pytest-cov
+        run: pip install pytest-cov ruff
+
+      - name: Ruff baseline
+        continue-on-error: true
+        run: ruff check app
 
       - name: Wait for PostgreSQL
         run: |
@@ -137,6 +141,124 @@ jobs:
           name: backend-coverage
           path: backend-service/coverage.xml
 
+  # ──────────────────────────────────────────────
+  # AI service — focused lint, import, and STT tests
+  # ──────────────────────────────────────────────
+  ai:
+    name: AI Lint, Import & STT Tests
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ai-service
+
+    env:
+      PYTHONPATH: .
+      APP_ENV: testing
+      DEBUG: "False"
+      DATABASE_URL: sqlite+aiosqlite:///./ci-ai.db
+      SECRET_KEY: ci-secret-key-not-for-production
+      GEMINI_API_KEY: ""
+      GROQ_API_KEY: ""
+      OPENAI_API_KEY: ""
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: ai-service/requirements.txt
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -c constraints-ai.txt -r requirements.txt ruff
+
+      - name: Ruff focused STT correctness checks
+        run: ruff check --select E9,F63,F7,F82 api/routes/stt.py api/services/stt tests/stt
+
+      - name: Check app import
+        run: python -c "from api.main import app; print(app.title)"
+
+      - name: Run focused STT tests
+        run: |
+          pytest \
+            tests/stt \
+            tests/test_dependency_constraints.py \
+            tests/test_lexi_session_management.py \
+            tests/trace_cag/test_edges_routing.py \
+            tests/trace_cag/test_pipeline_integration.py \
+            --tb=short -q
+
+  # ──────────────────────────────────────────────
+  # MCP server — import and startup protocol smoke
+  # ──────────────────────────────────────────────
+  mcp:
+    name: MCP Pytest & Startup Smoke
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: mcp-server
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: mcp-server/requirements.txt
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+
+      - name: Check server import
+        run: python -c "from server import server; print(type(server).__name__)"
+
+      - name: Run MCP resource, security, and startup tests
+        run: |
+          pytest \
+            tests/test_resources.py \
+            tests/test_security_configuration.py \
+            tests/test_integration.py::test_mcp_server_startup \
+            tests/test_integration.py::test_list_resources \
+            --tb=short -q
+
+  # ──────────────────────────────────────────────
+  # Admin — reproducible install, build check, Vitest
+  # ──────────────────────────────────────────────
+  admin:
+    name: Admin Build & Tests
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: admin-service
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: admin-service/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build and type check baseline
+        run: npm run build:check
+
+      - name: Run Vitest
+        run: npm test
+
   # ──────────────────────────────────────────────
   # Flutter — analyze + test
   # ──────────────────────────────────────────────
@@ -190,8 +312,8 @@ jobs:
           name: flutter-analyze-output
           path: flutter-app/analyze-output.txt
 
-      - name: Run unit tests
-        run: flutter test --no-pub -r compact test/core test/features
+      - name: Run full test suite
+        run: flutter test --no-pub -r compact
 
       - name: Check formatting (non-blocking)
         run: dart format --output=none --set-exit-if-changed lib/

.github/workflows/mirror-to-gitlab.yml

@@ -0,0 +1,24 @@
+name: Mirror to GitLab
+
+on:
+  push:
+    branches: ["**"]
+  delete:
+    branches: ["**"]
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Push mirror to GitLab
+        env:
+          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+          GITLAB_USERNAME: ${{ secrets.GITLAB_USERNAME }}
+          GITLAB_REPO: ${{ secrets.GITLAB_REPO }}
+        run: |
+          git remote add gitlab "https://${GITLAB_USERNAME}:${GITLAB_TOKEN}@${GITLAB_REPO}"
+          git push --mirror gitlab

.gitignore

@@ -129,9 +129,13 @@ system-testing/
 # deployment artifacts
 dist/
 build/
+*.tsbuildinfo
 .deploy/
 backups/
 
+# Runtime-generated knowledge graph sync metadata
+**/data/*_synced_files.json
+
 # gateway runtime security logs
 gateway/nginx/logs/*.log
 default.conf
@@ -149,6 +153,7 @@ scripts
 .claude/worktrees/
 
 # Local tool caches
+.claude/
 .claire/
 .crawl4ai/
 ai-service/.crawl4ai/

.gitleaks.toml

@@ -24,6 +24,14 @@ paths = [
   '''(^|/)lexilingo_app/lib/firebase_options\.dart$''',
 ]
 
+# Fake API keys used as test fixtures — not real credentials.
+[[allowlists]]
+description = "Test fixture placeholder API keys"
+targetRules = ["generic-api-key", "google-gemini-api-key", "gcp-api-key"]
+paths = [
+  '''(^|/)ai-service/tests/test_admin_routes\.py$''',
+]
+
 # These examples intentionally use non-secret placeholders.
 [[allowlists]]
 description = "Documentation and local gateway placeholders"

AGENTS.md

@@ -7,6 +7,7 @@
 | Code Reviewer | `.claude/agents/code-reviewer.md` | After any non-trivial change |
 | Test Writer | `.claude/agents/test-writer.md` | New feature or bug fix |
 | Security Reviewer | `.claude/agents/security-reviewer.md` | Auth, API, DB schema changes |
+| Kaiser | `.claude/agents/kaiser.md` | Technical debt audits, pre-sprint cleanup, when a service feels "heavy" |
 
 ## Ownership Map
 
@@ -18,6 +19,7 @@
 | `ai-service/` | main Claude | AI pipeline, STT |
 | Tests | test-writer | Never let main agent skip tests |
 | Security surface | security-reviewer | Routes, auth middleware, env vars |
+| Technical debt | kaiser | Debt register, architecture violations, dead code, complexity hotspots |
 
 ## Coordination Protocol
 
@@ -26,6 +28,7 @@
 3. **Spawn test-writer** after every feature implementation.
 4. **Spawn security-reviewer** when touching: auth routes, JWT handling, DB migrations, env/config files.
 5. **Spawn code-reviewer** before any PR — use `/code-review` skill.
+6. **Spawn kaiser** for quarterly debt audits, before major refactors, or when a module starts accumulating complexity.
 
 ## Task Decomposition (Large Tasks)